Manage Panorama and Firewall Configuration Backups
The running configuration on Panorama comprises all
the settings that you have committed and that are therefore active.
The candidate configuration is a copy of the running configuration
plus any inactive changes that you made since the last commit. Saving
backup versions of the running or candidate configuration enables
you to later restore those versions. For example, if a commit validation
shows that the current candidate configuration has more errors than
you want to fix, you can restore a previous candidate configuration.
You can also revert to the current running configuration without
saving a backup first.
After a commit on a local firewall that runs PAN-OS 5.0 or later,
a backup is sent of its running configuration to Panorama. Any commits
performed on the local firewall will trigger the backup, including
commits that an administrator performs locally on the firewall or
automatic commits that PAN-OS initiates (such as an FQDN refresh).
By default, Panorama stores up to 100 backups for each firewall,
though this is configurable. To store Panorama and firewall configuration
backups on an external host, you can schedule exports from Panorama
or export on demand. You can also import configurations from firewalls
into Panorama device groups and templates to Transition a Firewall to Panorama Management.
VMware ESXi and vCloud Air only
) VMware snapshot functionality
is not supported for a Panorama virtual appliance deployed on VMware
ESXi and vCloud Air. Taking snapshots of a Panorama virtual appliance
can impact performance, result in intermittent and inconsistent
packet loss, and Panorama may become unresponsive. Additionally,
you may lose access to the Panorama CLI and web interface and switching
to Panorama mode is
not supported. Instead, save and export your
named configuration snapshot to any network location.